Some XS pages use html macros without setting "clean" to "false"

whether the wrapped content or script cannot contain user-entered content.

I don't understand what difference that makes. Either user-generated content has been properly escaped, then it doesn't matter if we set clean to false or true, or it hasn't been escaped, then the content can contain {{/html}} and then it doesn't make any difference how the HTML macro was used.